feat(infra): migrate self-hosted backend to netralax.de

Move Supabase + LiveKit from the netralax.cloud VPS to a new netralax.de server. Adds the migration runbook (docs/), one-time move scripts (scripts/migrate/), and prod Caddy/LiveKit config templates (infra/). Repoints the desktop publish/changelog URLs and prod ops config to .de. JWT_SECRET + VAPID copied identically so already-installed clients keep working; the new server also serves the legacy .cloud hostnames.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/package.json

@@ -95,7 +95,7 @@
     "publish": [
       {
         "provider": "generic",
-        "url": "https://update.netralax.cloud/windows/"
+        "url": "https://update.netralax.de/windows/"
       }
     ]
   }

apps/desktop/src/lib/changelog.ts

@@ -1,11 +1,15 @@
 // In-app changelog feed.
 //
 // The release script (`scripts/release.mjs`) maintains a single
-// `changelog.json` file alongside `latest.json` on update.netralax.cloud.
+// `changelog.json` file alongside `latest.json` on update.netralax.de.
 // The list is newest-first, capped at 200 entries server-side, and rewritten
 // after every release.
+//
+// NOTE: already-installed clients still fetch this from update.netralax.cloud
+// (baked into their bundle), so Caddy on the new VPS must keep serving the
+// update.netralax.cloud vhost from the same directory during the transition.
 
-const CHANGELOG_URL = 'https://update.netralax.cloud/windows/changelog.json';
+const CHANGELOG_URL = 'https://update.netralax.de/windows/changelog.json';
 
 export interface ChangelogEntry {
   version: string;